NK-WP-0056: founder decisions folded in; runtime split into T11 and T12

Window-scoped write role (CCR-2026-0058 approved as amended), bind
self-rotation (pilot step is OPERATE on the one bind; svc-executor-pw
dropped), pilot without the PDP gate (not-evaluated), started event plus one
receipt per run, rapp Job in sso, owner workplans approved. New tasks: T11
core runner, T12 pilot operations and packaging; T06 depends on T12.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 994874@bnt-lap001
Assistant-Session: 6017c416-d619-47eb-bd1a-f670a02d7d87

examples/bounded-execution-admission/bind-split-read-only-verify.yaml

@@ -46,7 +46,7 @@ spec:
   plan:
     source:
       repo: net-kingdom
-      commit: 43a78907593a
+      commit: c9ab01e23e92
       files:
       - path: sso-mfa/k8s/lldap/bind-split.py
         sha256: 4decc3bbe65120ff6c4cef5613b9a41a60168ae64ecd4c1380f61a2fcd37b6b3
@@ -73,7 +73,7 @@ spec:
         scope: k8s/sso
       checks_after:
       - split-shape
-  plan_digest: sha256:c07dd58e6581049441d512edb60753bfe7102e3c89ea28d55081141373844d0d
+  plan_digest: sha256:0459999b93bb8aee0dacb1b36ea95d114ac74d0ed775095f3ee5dc2ee66203cd
   checks:
   - id: split-shape
     description: every consumer binds as its own svc- account; no service binds as admin